e13aabc5579f1c0d7b65881ea3a354d354f11034a4ad15f6ec1651470cc15e73

General

Target

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Size

261KB
MD5

4de76198ea4488eae192d0ca4e4bd66b
SHA1

5ac5585b13ea356969b168b86df12053a6de4ee2
SHA256

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302
SHA512

db6c2ebbd9d01ebf8af3e68ef8e938c7b6da2c0eef5fc22f63fe69665c56ec19c2d241558984e03afb116b98a4e7dc2b0f4aa8dadd90f44caf3f72ae5f2ee52f

Score

10^/10

spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.ionos.fr
Port:
587
Username:
[email protected]
Password:
pilote30

Signatures

Drops startup file 1 IoCs

Processes:

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REZZZS.js	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

description	pid	process
Token: SeDebugPrivilege	1656	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Token: SeDebugPrivilege	1512	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

description	pid	process	target process
PID 1656 wrote to memory of 1512	1656	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
PID 1656 wrote to memory of 1512	1656	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
PID 1656 wrote to memory of 1512	1656	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe	150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

C:\Users\Admin\AppData\Local\Temp\150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
"C:\Users\Admin\AppData\Local\Temp\150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
"C:\Users\Admin\AppData\Local\Temp\150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-8-0x0000000000000000-mapping.dmp

Download
memory/1512-13-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1512-14-0x0000000000AE6000-0x0000000000B05000-memory.dmp

Filesize
124KB

Download
memory/1512-12-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

Filesize
8KB

Download
memory/1512-10-0x000007FEF6380000-0x000007FEF6D1D000-memory.dmp

Filesize
9.6MB

Download
memory/1512-9-0x000007FEF6380000-0x000007FEF6D1D000-memory.dmp

Filesize
9.6MB

Download
memory/1656-5-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1656-7-0x00000000009F6000-0x00000000009F7000-memory.dmp

Filesize
4KB

Download
memory/1656-6-0x00000000009D6000-0x00000000009F5000-memory.dmp

Filesize
124KB

Download
memory/1656-11-0x00000000009F5000-0x00000000009F6000-memory.dmp

Filesize
4KB

Download
memory/1656-2-0x000007FEF6380000-0x000007FEF6D1D000-memory.dmp

Filesize
9.6MB

Download
memory/1656-4-0x00000000009D0000-0x00000000009D2000-memory.dmp

Filesize
8KB

Download
memory/1656-3-0x000007FEF6380000-0x000007FEF6D1D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads